AI is accelerating the discovery of software vulnerabilities, pushing the industry into a “vulnpocalypse” where frontier AI models turbocharge bug finding and testing. The piece notes that large language models have already sped up large portions of the bug discovery pipeline, with bug bounty platforms reporting dramatic increases in reports triaged.
Hackers and researchers increasingly rely on AI-powered triage, and some believe the new reality will prioritise volume over severity as the security research economy reconfigures around higher throughput.
Vendors and researchers are grappling with the consequences. Aaron Portnoy, Mindgard founder and Pwn2Own co‑founder, argues that AI’s scale means vulnerabilities can no longer be hidden, forcing software makers to face accountability sooner. Katie Moussouris of Luta Security describes the velocity shift as a secure-by-design reckoning: bug bounty platforms should supplement, not replace, the process of finding and fixing flaws.
The article cites that over the past year, the number of critical vulnerabilities sitting in backlogs has increased by about 30 times, even as remediation efforts have improved in mean time to fix. Organisations are trimming back some bug bounty programmes and adding gating measures to slow submission rates, while vulnerability disclosure remains a bottleneck. Casey Ellis warns that many researchers lack clear reporting channels or safe harbour policies, complicating rapid disclosures as AI accelerates discovery.
The piece concludes that while AI helps identify more flaws, the industry’s challenge is adapting remediation, disclosure channels, and governance to keep pace.